Skip to content

Respect the OS certificate store  #39

@qc00

Description

@qc00

Describe the bug
The "GitHub Actions language server" doesn't use Root certificates installed on Windows, so incompatible with an SSL-inspecting firewall.

Most other extensions in VSCode work just fine and are able to access HTTPS endpoints correctly. I presume they use a different API.

To Reproduce

  1. Be in an enterprise environment with an SSL-inspecting/MITM firewall that uses certificates issued by an internal CA.
  2. Open any workflow yml file
  3. In the ouptuts:
Failure to retrieve username:  Os [HttpError]: request to https://api.github.com/user failed, reason: self signed certificate in certificate chain
    at c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2783247
    at process.processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855206
    at async fa.get (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2865045)
    at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855141
    at async aa (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855108)
    at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858843
    at async Object.getContext (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858799)
    at async ni (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2732594)
    at async ln (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2757296) {
  status: 500,
  request: {
    method: 'GET',
    url: 'https://api.github.com/user',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'VS Code GitHub Actions (0.25.2) octokit-rest.js/19.0.7 octokit-core.js/4.1.0 Node.js/16.14.2 (win32; x64)',
      authorization: 'token [REDACTED]'
    },
    request: { hook: [Function: bound bound e] }
  }
}

Expected behavior
Certificates trusted by Windows are accepted.

Extension Version
v0.25.2

Additional context
I wonder if it's HSTS?

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    Status

    Triaged 📝

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions